hxxps://go[.]dev/dl/go1[.]22[.]5[.]windows-amd64[.]zip/

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://go.dev/dl/go1.22.5.windows-amd64.zip/
Sample260811-215yestfle

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1256	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309630417401016"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{D573FF4D-0868-48A9-9807-ACB5658B70FA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1544	1616	msedge.exe	86
PID 1616 wrote to memory of 1256	1616	msedge.exe	87
PID 1616 wrote to memory of 1624	1616	msedge.exe	88
PID 1616 wrote to memory of 1624	1616	msedge.exe	88
PID 1616 wrote to memory of 1624	1616	msedge.exe	88
PID 1616 wrote to memory of 2076	1616	msedge.exe	90
PID 1616 wrote to memory of 2076	1616	msedge.exe	90
PID 1616 wrote to memory of 2168	1616	msedge.exe	91
PID 1616 wrote to memory of 4712	1616	msedge.exe	92
PID 1616 wrote to memory of 2168	1616	msedge.exe	91
PID 1616 wrote to memory of 2168	1616	msedge.exe	91
PID 1616 wrote to memory of 4712	1616	msedge.exe	92
PID 1616 wrote to memory of 4712	1616	msedge.exe	92
PID 1616 wrote to memory of 4944	1616	msedge.exe	93
PID 1616 wrote to memory of 4944	1616	msedge.exe	93
PID 1616 wrote to memory of 4944	1616	msedge.exe	93
PID 1616 wrote to memory of 4020	1616	msedge.exe	94
PID 1616 wrote to memory of 4020	1616	msedge.exe	94
PID 1616 wrote to memory of 4020	1616	msedge.exe	94
PID 1616 wrote to memory of 3808	1616	msedge.exe	98
PID 1616 wrote to memory of 3096	1616	msedge.exe	99
PID 1616 wrote to memory of 3808	1616	msedge.exe	98
PID 1616 wrote to memory of 3096	1616	msedge.exe	99
PID 1616 wrote to memory of 3656	1616	msedge.exe	101
PID 1616 wrote to memory of 4068	1616	msedge.exe	104
PID 1616 wrote to memory of 4136	1616	msedge.exe	105
PID 1616 wrote to memory of 2356	1616	msedge.exe	106
PID 1616 wrote to memory of 4824	1616	msedge.exe	107
PID 1616 wrote to memory of 4824	1616	msedge.exe	107
PID 1616 wrote to memory of 1832	1616	msedge.exe	108
PID 1616 wrote to memory of 1832	1616	msedge.exe	108
PID 1616 wrote to memory of 4700	1616	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go.dev/dl/go1.22.5.windows-amd64.zip/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc57fbc188,0x7ffc57fbc194,0x7ffc57fbc1a0
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,7126302120912442563,13658691020199755135,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,2703381208326897238,3292183518549198342,262144 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,3001399244930054493,6326945161258670706,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,7331789645896318998,7961424537879822864,2097152 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,1342873120050779070,9432309380589321813,2097152 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,11630158209146212165,7587723039667696215,2097152 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,14024177148717086077,6966410335767884660,2097152 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,11114111682240530627,18164020947625375220,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,15413945384544268752,15984933558268969772,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,9516758554938342499,16068907546605912926,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,9516758554938342499,16068907546605912926,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,6823567893900777713,5949469049955159639,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,9564326235126534901,5231803530159930276,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,3260245967929182538,17336120216580819127,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,885464489232936668,13736105356893910261,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,6349046602870717318,18413137497661013112,524288 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5320,i,591771234210160399,1562276478313527833,262144 --field-trial-handle=2080,i,17179099002738328609,14723546351798264237,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 de51b12a380d865e7ab6910fe546e2ddba2c76a64fa8accc1d35ec2b4351ea48
MD5 6e907d0ad46f79fce916c5aa025d2838
SHA1 be2e6cdb4908acdca14fdbed693378080935c75d
SHA512 534b382fddb4273388bf673ece24fb681795cfc78359a2d290535c7f04d79f36157f3b44134e9ce6356dee2f166943a25a4d2974f269fc3f43b724c6811f5a68
TLSH
T13971E53B0139446DE353C27186DA82123C7A4EEAF5C35E45B0E05B3D59823F2DE26A8B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e0660a4990f4cfd04bb67624af4ecd1af46e23395ee38b5ac4cfb73699ac93a8
MD5 d81dec146fc4b73e9d810a4af996c29d
SHA1 b354acfbc85bcc12c5e803ab3d47f6e3dff8977e
SHA512 a4c6f496e389e7a8c50bb9ed71fc75cbff2fc989c8df021754bba079a91003969331bb455a3f89dfe1c2b542824b416be7368366f5a16a525c68ae8b9b79cebe
TLSH
T1EF118CF3C3E585BE8D1156F09A24AE2BDE1E0606431C3C198AD4EF6B97E3475E00695B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f14e66f74d84b92fae6ddff6a51b20ecdc3b740d243ace6eb7c808a860b26fe
MD5 c308c3da0a7cca8c0aa8bc872543aa11
SHA1 053d8b4beebc6f56eae79e57471afc5f6321ef9a
SHA512 aaf9b36931366f33e353bee7e37b9a66680aec7064320150666fb722b7bb880970bae91faa552d073fd1e075a0c358e0c34a7ae64c889976cae03de9aacf2031
SSDEEP 192:sxZdRgyM/jK1Ml8Mkw/fFsQLkIdpo9YHW6+WN33t/YIcaDk+mIgrJ:sxZdOMw/fFsQL9gYHbN/yxr9
TLSH
T1B142F7116A34AA77CCCBD209F945BF53D6F95472A2900E54A9FCDA1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 936e8d00ca7e2139a7e9145631652f0db754d19abbfa160466cd0fd14fb2e141
MD5 99b494d7a1769d8ffff026dd698eb2a8
SHA1 4295355a05affb2803437a9933272284075e692c
SHA512 4eff9e580bf22624401216e05bc0e81ab8f8353618f9d0fe6916fd4ff1367bc358d6f0b68ee776e310f1445314ef446b2490aaa221a84d1a5659a1256cd5159a
SSDEEP 192:sxZdRgyM/jK1Ml8UQgkw/fFsIVkIdpS9YHW6+WN33t/YIP+q+mIg5jJ:sxZdOqzw/fFsIV9WYHbN/Prr
TLSH
T1EF52F712AA345A77DCDBD20DB945BF53D6F854B2A1900E44A9FCDA1C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 933ee0e5a709d6c14db8ac7dc5b07214ca2c1ebf18d9bdb9170e3929d5145e09
MD5 5269ca859c59a8a3f6bea9698d7dd334
SHA1 6224a4f222a149edf1850a95fa8bb675910b734e
SHA512 2d48a9d4bad178770edec88a8a42099b7eda5615aed1e68d2e3d67e6838090458cd0b9808f6a751e5620ca6b863f3be6801961326b4e1d5208c2e3f13f07d8b5
SSDEEP 768:Z1sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9erorDb:Z1sqxXlWvJD6Tu1ja54LAs91rv
TLSH
T156D21C3B694CC77E4F840E6DEC266FD76ED801CB66988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 56b0fa9632fb695b486e92a2572d94d2cf645cf53e0293f22961a5b21ff112f9
MD5 59f79552dd5172288d07252b64af884e
SHA1 9b29128c1b49d22eebccf58755a0195fd31f6aed
SHA512 1ed72729a775ae5f56ca3487293feebcb981565b565a9f4b310f62920a55ab9b59ab2942a146af3f26f045dd49fbeb2b9685aef76de6c0c8d02f80192ef1313c
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyJ2IXK7KEHyh5CIfKfqMHy5WInKPK89:KYbaKYIKa2wK7Kui5CAKfqGqWgKPKK
TLSH
T13DD1FF46753B02427CBD294CA7FA96374F4232A33419A46F3FB851A65E66E110DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

884b3992-9384-45ed-921d-6f38edca2c28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\884b3992-9384-45ed-921d-6f38edca2c28.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 05b1e80683f579fea882714a056ac23b5d5a82ea34a3b795a39fbe84d3956fd0
MD5 61723a122ffc660bbc5e4ff126a14dcb
SHA1 6236ec924c309c87f2c57c492b188b73088f71c6
SHA512 ae85931e120668ba3fdbb45d6c241684e5b68967b3dd4d6f9ff1a4811c7f4f8fe397c22718b7faa2c76b2606a305e9471fac17469db7cfeccdc6e1245eae33ee
SSDEEP 384:nZcIhsN5Up0bOJT4VRNkd/toQLMsRnlYxd:PhPTuHkvoChn2L
TLSH
T1C3927D329C782D7769F6A506F48731034EF4916BBAC96F9491ECDF0C01DA9AD130AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 0fe686968fe897c3a4da6520b218757d033c2acbc68cce425032836a1366b23e
MD5 31d36ed10efab23f144d29898ac0cdc8
SHA1 9f443ac66ac3083ff590b599009a8d61aab79f34
SHA512 2e37979ee172865425a68957c09b85a36c9ffad8b20075478e8f7fc1a2e9cc67d12593ad84220bbda1ec4f98eca14555a9870884647bcf02cdf138468151750f
SSDEEP 384:piFiZcIusNa8TUNTUlIlQ0bOJT4VRNkd/6oQLMsRnlYxd:AFQuPwgYTuHkkoChn2L
TLSH
T14AA27D339C685D7BADF69A45F94A32038EF490A7E9C5BF94A2DC9F0C01DA59C1306C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e67a6fbad5def3c3c1d713245b9bdf7180ae121521752e1e87e72fb62855c4c
MD5 2148fea99e69c717f9092405e7d0ccb0
SHA1 a4c7981878d1f1d2ff7075046c95516b6501a816
SHA512 10b091d0e2e736e8bb4712ea6093e29c71733077aa252fb85d7d7fc2cc778cc4a7c755c71ec00d8a0d8a8978c11261a1b35a3bda4372ec841c6af0b19fb010e3
SSDEEP 192:tONu6JkRtQmiUyCKW+RNX+Fd10IeReh3oCPR7U6:tONu6UrcW+RNkd/FoClU6
TLSH
T15602C835AC382C7B9EF2AE09B58737175FA4216BBA952B84D6E81F0C01D765C1346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 77b500c31de2baa87deb0d02ed80df41dabb86346628993ab67b6aa799cd1d17
MD5 05b4317202425315dad9c7d36af435c0
SHA1 13e7aef3665d31c478591f25b9ace6b073063446
SHA512 6cabe47760ec83cccb7ff1e43c0f0cf1b0f90309f364eaf70fb8fc610755137ed774aef9a2df271253209e4e0162fe20e9202499f3e9fbed170a2f37b0f1f042
SSDEEP 384:1ZcIhsN5UQ0bOJT4VRNkd/toQLMsRnlYxd:NhoTuHkvoChn2L
TLSH
T123927D329C782D7769F6A506F48732035EF4D06BBAC96F9491ECDF0C01DA9AD130AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ec2d0eabc3da726a5bb841e58b3c27ea155ba71f15102814b984769e79e02242
MD5 0c0d52527bb2e64942d2765c17f67596
SHA1 3df6cb4507803f1e4d8ecdd3ab34b919eac03015
SHA512 1081f65b13a441a406da357da77681e8f91adf4b52ddec5757b1e9c7cd7025b90c3626089b35835c063a18a5cd8850177eed5edd3626120ad721ad9b41aab01c
SSDEEP 192:EONT6JkRNQmiUyJK8+RNX+Fd10IeRfFgVcoVqb3LU6:EONT6UL98+RNkd/GoQLU6
TLSH
T1F5121A3568382C7B5EA26905F48736035EE4916BEA897F90D5DC1F0C01EF6AC234A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ee7fd8f1308a324eefb280474e1fcef865555a07263a6267f6a842b7fdc9f646
MD5 1792cd15f7d5f2d319229f92c06b940d
SHA1 c6dd92e5f555e04da317f6a9993846ae85b76df5
SHA512 818497c06a4e594ee9520233c7e6bd39de0765ec5ae61028e8834ca8350ff84963129bfd1aee769e00bd274d286ccfd18400038d43de84784bc4b941c752cb6d
TLSH
T16D41E65CB6EA1148B3B7AE5AABF6A86D447FB8772E46D45D00050D4E0A26F40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download